Cookie policy

This translation is for information only. If there is any discrepancy, the Spanish version prevails.

What cookies are

Cookies, and other similar techniques such as the browser's local storage, are small pieces of data that a website stores on your device and reads back later. They can be used for very different things: keeping you signed in, remembering a preference, measuring visits or showing you advertising.

What we use on xpoly.es

Only what is essential for the website to work and what you choose. We do not use analytics, advertising or social media cookies, and no third parties set cookies for their own purposes. That is why we do not ask you to accept anything and you do not see a cookie banner when you arrive: these cookies do not require your consent, but we tell you what they are.

Name	Whose	What for	How long it lasts	When it appears
`xpoly_acceso`	Xpoly	Keeping you signed in: it tells our server that it is you	Up to 14 minutes, and it renews itself while you browse	Only if you sign in to your account
`xpoly_renovacion`	Xpoly	Renewing your session without asking for your password again	14 days	Only if you sign in to your account
`xpoly_carrito`	Xpoly	Remembering which items you have put in your basket and how many (only that: no prices and no personal data)	30 days, or until you empty it	Only if you add something to your basket
`xpoly_google_ida`	Xpoly	When you click ‘Sign in with Google’, checking on your return that it is you coming back, in this browser, from the sign-in you started here	10 minutes, and it is deleted when you return	Only if you click ‘Sign in with Google’
`xpoly_google_paso`	Xpoly	When you return from Google, remembering the step still to be done —creating your account or linking it with your password— while you do it	10 minutes, or until you finish or abandon it	Only if you return from Google without a linked account
`xpoly_google_aviso`	Xpoly	Showing you why signing in with Google did not work	2 minutes, or until your next action	Only if signing in with Google does not work
`xpoly_idioma`	Xpoly	Remembering the language you chose for the website (Spanish, Galician, English or French)	1 year	Only if you change the language
`xpoly-tema` (local storage, not a cookie)	Xpoly	Remembering whether you chose the light or dark theme	Until you choose ‘System’ or clear your browser data	Only if you change the theme
`xpoly-cookies` (local storage, not a cookie)	Xpoly	Remembering how you answered the cookie banner, so that we do not ask you on every visit: the date, which uses you were asked about, what you accepted and, if you accepted anything, that you said you were 14 or over. It never leaves your browser	12 months from when you answer; after that we would ask you again	Only if you answer the cookie banner. There is no banner today, so today nothing is stored
`cf_clearance`	Cloudflare	Remembering that you have already passed a security check, so that you are not asked again	30 minutes (Cloudflare's default value, which we have not changed)	Only if Cloudflare shows you a check because the traffic looks automated

The two session cookies, the basket cookie, the language cookie and the three Google sign-in cookies are HttpOnly (the page's code cannot read them, so neither can a malicious script), SameSite=Lax and Secure (they only travel over an encrypted connection). ‘Sign out’ deletes the session cookies; the basket cookie is emptied when you remove what is in it. It is just as technical: without it there is no basket.

Cloudflare is our network provider: all the website's traffic passes through it to protect the site. Its list of cookies is at https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/. We have switched off its bot protection (Bot Fight Mode), which is what would set another cookie, __cf_bm.

Payment. Today you cannot yet pay on the website, so there is no payment cookie, neither ours nor a payment gateway's. When card payment becomes possible, this policy will first say which cookies the payment gateway sets.

Xpoly staff. The administration panel, used only by our staff, also sets Django's technical cookies sessionid (the session, 2 weeks) and csrftoken (form protection, 1 year). They do not appear in the shop.

How to remove them

In ‘Cookie preferences’, at the foot of every page, you can see at any time what we use and what you have decided. Today there is nothing to switch off there: everything is technical.

As they are technical, if you block them you will not be able to sign in to your account or buy, but you can do so in your browser settings:

If this changes

If we ever use cookies that are not technical —for example, to measure visits—, we will not set them before you decide: you will see a banner with ‘Accept all’ and ‘Reject all’ buttons that are equally visible, and you will be able to choose by purpose. Continuing to browse without answering does not count as accepting. To accept, we will ask you to tick a box confirming that you are 14 or over; if you are younger, your father, mother or guardian must decide. And you will be able to change your mind whenever you like, just as easily, in ‘Cookie preferences’, at the foot of every page: if you withdraw a permission, we delete whatever those cookies had left. Your answer is valid for 12 months, and we would ask you again sooner if what we use changes. This policy will be updated beforehand.

What we do with the data that passes through these cookies is set out in the privacy policy.

Version: 30 October 2026.